L1 and L2 · entry to mid · 17 questions with answers
SOC interviews are scenario-driven. Interviewers care far less about definitions than about the order you do things in when an alert fires at 2am. These questions mirror how managed SOC and in-house teams in India actually screen L1 and L2 analysts.
You'll answer these out loud, under time pressure, with an interviewer asking follow-ups. Do a free 5-question AI mock interview and get scored feedback in minutes — no card needed.
Start free mock interviewConfirm the account and source IP, check whether the source is expected for that user (geo, device, VPN), look at what the session did after login — new mailbox rules, privilege changes, data access. If it looks real: disable the session and account, force credential reset, and escalate with a timeline. Say the order out loud; that's what's being scored.
Decode the base64 to see the intent, get the parent process — Word or Outlet spawning PowerShell is a strong signal — check the user, look for network connections and child processes, and search for the same pattern across other hosts. Contain the host if there's outbound C2, then collect artefacts before wiping anything.
Reset the password and revoke all active sessions and tokens, check for mailbox rules or MFA device registrations added since the click, and search proxy and mail logs for anyone else who received or clicked the same link. Then block the URL and sender.
Destination reputation and geolocation, whether the process is a known backup or sync client, the size against that host's baseline, and whether the user account was active. Backup jobs and OS updates cause most of these; the differentiator is whether the destination and process are expected.
By asset criticality and stage of attack, not by arrival time. A single alert on a domain controller or a crown-jewel database beats 20 low-severity ones on test machines. Group duplicates from the same root cause, and tell your lead early if the queue is beyond one analyst.
Name the tool — Splunk, Sentinel, QRadar, Wazuh, Elastic — and describe one dashboard or rule you built, its logic, and what it caught. A home lab counts. "I shipped Sysmon logs into Wazuh and wrote a rule for parent-child anomalies" is a real answer.
Identity (AD and cloud IdP), endpoint (EDR and Sysmon), firewall and proxy, DNS, email gateway, and cloud control-plane logs. Identity first, because almost every modern intrusion touches authentication somewhere.
Start from a hypothesis and a specific technique, baseline what normal looks like for a week, add exclusions for known-good service accounts and admin tooling, and set severity by asset. Then review the rule's true-positive rate after two weeks and either tune or retire it.
Combining events from different sources into one meaningful signal. Example: a VPN login from a new country, followed within minutes by a mail-forwarding rule, then a bulk file download from SharePoint. Any one is unremarkable; the chain is a business email compromise.
4624 successful logon and its logon type, 4625 failed logon, 4672 special privileges assigned, 4688 process creation with command line, 4720 account created, 4768/4769 Kerberos tickets, 7045 service installed, and 1102 log cleared. Explain the logon types on 4624 — type 3 network and type 10 RDP tell very different stories.
User and entity behaviour analytics — baselining what normal looks like per user and device, then alerting on deviation instead of on static signatures. It catches credential misuse that no signature will, at the cost of a warm-up period and more false positives early on.
You'll answer these out loud, under time pressure, with an interviewer asking follow-ups. Do a free 5-question AI mock interview and get scored feedback in minutes — no card needed.
Start free mock interviewL1 monitors the queue, triages against playbooks and escalates with a clear summary. L2 does deeper investigation, host forensics, threat hunting and rule tuning, and owns the incident through containment. Saying you want to move to L2 by learning detection engineering is a strong answer to the ambition question.
What fired and when, affected user and asset, what you verified and how, what you ruled out, current containment status, and your recommendation. An escalation that makes the L2 redo your work is worse than no escalation.
Security orchestration, automation and response — automating repetitive triage steps like IP enrichment, user lookups, and mass phishing-report handling. It helps most where the decision is deterministic; it hurts if you automate a step that needed judgement.
Read the rule logic to understand exactly what triggered it, gather context around the event, check internal history for the same rule, research the technique, and time-box it before escalating with what you found. Never close as false positive because you don't understand it.
Mean time to detect, mean time to respond, alert-to-incident ratio, false-positive rate per rule, and coverage against ATT&CK. Note that raw alert volume is a vanity metric — fewer, better alerts is the goal.
Handover notes both ways, a fixed rhythm for queue sweeps versus deep work, and using quiet hours for hunting or documentation rather than staring at a console. Interviewers ask this because burnout drives SOC attrition.
Triage order, Windows and Linux logging basics, common Windows event IDs, one SIEM hands-on, phishing analysis, and the incident response lifecycle. Scenario answers matter more than definitions.
Often yes — a log sample to interpret, a phishing header to analyse, or a live scenario walkthrough. Practising your answers out loud is the closest preparation to the real format.
Yes — L1 is the most common entry point into Indian cyber security. A home lab with real log analysis and a clear triage narrative usually beats certifications alone at that level.
You'll answer these out loud, under time pressure, with an interviewer asking follow-ups. Do a free 5-question AI mock interview and get scored feedback in minutes — no card needed.
Start free mock interview